Advisories on Bangladesh Vulnerability Database

Neve Pro Addon password-protected content bypass

Sat, 07 Nov 2026 00:00:00 +0000

Summary

In the Content Protection feature of Elementor Booster in Neve Pro Addon 3.2.14, password-protected widget content could be shown to a visitor who did not know the password. The server checked that a password cookie existed instead of checking its value, and the same cookie unlocked widgets that had different passwords. The full range of affected Neve Pro Addon and Elementor versions has not been established.

Bdtask Garage 24 Garage Management Software Backend improper authorization

Mon, 26 Oct 2026 00:00:00 +0000

Summary

From the CVE record: A weakness has been identified in Bdtask Garage 24 Garage Management Software 1.0. This vulnerability affects unknown code of the component Backend. Executing a manipulation can lead to improper authorization. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting

Mon, 26 Oct 2026 00:00:00 +0000

Summary

From the CVE record: A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of the file /edit_profile of the component Profile. The manipulation of the argument first_name/last_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Omega Solution Restro POS sale-invoice logic error

Mon, 26 Oct 2026 00:00:00 +0000

Summary

From the CVE record: A vulnerability was determined in Omega Solution Restro POS up to 20261026. This impacts an unknown function of the file /sale-invoice/. Executing a manipulation of the argument productUnitSalePrice can lead to business logic errors. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

bewCloud passkey login accepts a replayed WebAuthn assertion

Sun, 18 Oct 2026 00:00:00 +0000

Summary

bewCloud’s passwordless passkey login did not store the challenge it issued. The verification step took the challenge from the request itself, so a captured signed passkey response could be sent again to open a new session.

Impact

An attacker who captured a valid passkey login response could reuse it to log in as that user. The reporter notes that the effect is limited for passkeys that use an increasing signature counter.

bewCloud public file shares path traversal allows unauthenticated file read

Sun, 11 Oct 2026 00:00:00 +0000

Summary

In bewCloud, a valid public file share link could be used to read files outside the shared folder, including other users’ files that the server process can read, without logging in. The reporter describes it as a bypass of the fix for an earlier path traversal issue (#48).

Omega Solution CoinEx Crypto Customer Information API customer-currency authorization

Sun, 04 Oct 2026 00:00:00 +0000

Summary

From the CVE record: A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer Information API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The product web site does not exist anymore. Maybe the product got retired and/or replaced. The vendor was contacted early about this disclosure but did not respond in any way.

Omega Solution CoinEx Crypto Customer Profile API customer authorization

Sun, 04 Oct 2026 00:00:00 +0000

Summary

From the CVE record: A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile API. Executing a manipulation of the argument ID can lead to authorization bypass. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The product web site does not exist anymore. Maybe the product got retired and/or replaced. The vendor was contacted early about this disclosure but did not respond in any way.

Omega Solution CoinEx Crypto Support Ticket API customer information disclosure

Sun, 04 Oct 2026 00:00:00 +0000

Summary

From the CVE record: A security flaw has been discovered in Omega Solution CoinEx Crypto 2025. Affected is an unknown function of the file /ticket/customer of the component Support Ticket API. The manipulation of the argument status/page/count results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The product web site does not exist anymore. Maybe the product got retired and/or replaced. The vendor was contacted early about this disclosure but did not respond in any way.

Omega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting

Sun, 04 Oct 2026 00:00:00 +0000

Summary

From the CVE record: A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file /user/ticket of the component Ticket Attachment Upload. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The product web site does not exist anymore. Maybe the product got retired and/or replaced. The vendor was contacted early about this disclosure but did not respond in any way.

Omega Solution FBP Fulfillment by People User Profile API user authorization

Mon, 21 Sep 2026 00:00:00 +0000

Summary

From the CVE record: A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Omega Solution HRM OS Role Permission API permission missing authentication

Mon, 21 Sep 2026 00:00:00 +0000

Summary

From the CVE record: A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injection

Mon, 21 Sep 2026 00:00:00 +0000

Summary

From the CVE record: A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource identifiers. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Omega Solution HRM OS SVG File Upload view cross site scripting

Mon, 21 Sep 2026 00:00:00 +0000

Summary

From the CVE record: A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy

Mon, 17 Aug 2026 00:00:00 +0000

Summary

From the CVE record: A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes observable response discrepancy. The attack can be initiated remotely. The attack’s complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.0.0-beta.33 is able to resolve this issue. Patch name: eac0b05dafdb0ddf8b9139dad8929aaba86568ca. You should upgrade the affected component.

CodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization

Mon, 17 Aug 2026 00:00:00 +0000

Summary

From the CVE record: A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save_contact of the component Contact Information Update. Such manipulation of the argument contact_id leads to authorization bypass. The attack can be launched remotely. The exploit is publicly available and might be used.

BichitroGan ISP Billing Software Customer edit cross site scripting

Mon, 20 Apr 2026 00:00:00 +0000

Summary

From the CVE record: A vulnerability was identified in BichitroGan ISP Billing Software 2025.3.20. This affects an unknown function of the file /?_route=customers/edit/ of the component Customer Handler. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

BichitroGan ISP Billing Software Pool List add cross site scripting

Mon, 20 Apr 2026 00:00:00 +0000

Summary

From the CVE record: A weakness has been identified in BichitroGan ISP Billing Software 2025.3.20. Affected is an unknown function of the file /?_route=pool/add of the component Pool List Interface. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

BichitroGan ISP Billing Software Profile users-view cross site scripting

Mon, 20 Apr 2026 00:00:00 +0000

Summary

From the CVE record: A security flaw has been discovered in BichitroGan ISP Billing Software 2025.3.20. This impacts an unknown function of the file /?_route=settings/users-view/ of the component Profile Page Handler. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.

BichitroGan ISP Billing Software Endpoint users-view resource injection

Sun, 29 Mar 2026 00:00:00 +0000

Summary

From the CVE record: A vulnerability was found in BichitroGan ISP Billing Software 2025.3.20. Impacted is an unknown function of the file /?_route=settings/users-view/ of the component Endpoint. The manipulation of the argument ID results in improper control of resource identifiers. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Bdtask Bhojon All-In-One Restaurant Management System Add-to-Cart Submission Endpoint addtocart logic error

Thu, 29 Jan 2026 00:00:00 +0000

Summary

From the CVE record: A vulnerability was identified in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The impacted element is an unknown function of the file /hungry/addtocart of the component Add-to-Cart Submission Endpoint. The manipulation of the argument price/allprice leads to business logic errors. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Bdtask Bhojon All-In-One Restaurant Management System Checkout placeorder logic error

Thu, 29 Jan 2026 00:00:00 +0000

Summary

From the CVE record: A vulnerability was determined in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The affected element is an unknown function of the file /hungry/placeorder of the component Checkout. Executing a manipulation of the argument orggrandTotal/vat/service_charge/grandtotal can lead to business logic errors. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Bdtask Bhojon All-In-One Restaurant Management System User Information profile cross site scripting

Thu, 29 Jan 2026 00:00:00 +0000

Summary

From the CVE record: A vulnerability was found in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. Impacted is an unknown function of the file /dashboard/home/profile of the component User Information Module. Performing a manipulation of the argument fullname results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Bdtask SalesERP Administrative Endpoint improper authorization

Thu, 29 Jan 2026 00:00:00 +0000

Summary

From the CVE record: A vulnerability has been found in Bdtask SalesERP up to 20260116. This issue affects some unknown processing of the component Administrative Endpoint. Such manipulation of the argument ci_session leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Bdtask Flight Booking Software Edit Profile edit unrestricted upload

Sun, 16 Nov 2025 00:00:00 +0000

Summary

From the CVE record: A weakness has been identified in Bdtask Flight Booking Software 4. Affected by this vulnerability is an unknown functionality of the file /agent/profile/edit of the component Edit Profile Page. This manipulation causes unrestricted upload. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution submit_checkout behavioral workflow

Sun, 16 Nov 2025 00:00:00 +0000

Summary

From the CVE record: A security vulnerability has been detected in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution 5. Affected by this issue is some unknown functionality of the file /submit_checkout. Such manipulation of the argument order_total_amount/cart_total_amount leads to enforcement of behavioral workflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution manage_customer cross site scripting